> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # The sole platform-global compliance guard (invariant #68) > Every compliance control on Devotel Orbit is tenant-owned and default-open, with exactly one exception: the US federal TCPA voice dialing window. This page states the carve-out rule, explains why no tenant toggle exists for it, and maps the four ways operators meet it. # The sole platform-global compliance guard Every compliance control you configure on this platform is yours. Quiet hours, DNC and consent checks, country blocks, frequency caps: you enable them, you tune them, you switch them off, and the platform follows. They default open, and when an input cannot be resolved they fail open, because the cost of a misconfiguration is yours to price. Exactly one control is different. The US federal TCPA voice dialing window, 8:00 AM to 9:00 PM recipient-local time, is always on for every tenant, accepts no setting from your account, and refuses the dial when it cannot prove the call is lawful. This page is the canonical statement of that rule: what it is, why it alone is global, what its refusals look like, and the definitive list of what you can and cannot do about it. ## 1. The carve-out invariant The platform's compliance posture is tenant-owned. Orbit is the conduit and the platform; it does not own, mandate, or globally gate your regulatory compliance. Every control is tenant-configurable, defaults off or open, and fails open on unresolvable input. The single exception is the federal voice dialing window (47 U.S.C. § 227(b)(1)(B), 47 CFR § 64.1200(c)(1)). Restated as a rule: > Your tenant quiet-hours and every other compliance control are > yours. The federal voice dialing window is the platform's sole > guard that no tenant can toggle. The reason is statutory, not philosophical. The federal penalty is $500 to $1,500 **per call**, assessed against whichever platform originated the call, regardless of which tenant config value caused it. For every other gate, the risk of your misconfiguration is yours, so the control is yours. For the federal window the penalty is not yours to waive, so the control is not yours to disable. That asymmetry is the whole doctrine: ownership follows liability. The guard is implemented once, in the shared compliance package at `packages/compliance/src/voice-guard.ts`, so every voice dispatch path consults the same verdict logic and the posture cannot drift between paths. Its non-toggleability and fail-closed behavior are held by a paired pin, `packages/compliance/src/__tests__/voice-guard-invariant-68-carve-out.test.ts`, which fails if the guard ever learns a bypass or starts failing open. This page is the operator-facing statement of the same contract. ## 2. What the guard means in operator terms Three properties distinguish it from everything else in your send path: * **Always on.** It applies to automated voice dispatches to +1 recipients on every account, on every plan, with no setting that names it. There is no screen, API field, or support-runbook step that changes it. * **Fail-closed.** When the recipient's timezone cannot be resolved, the dial is blocked, not allowed. This is the opposite of your own gates: at your quiet-hours gate an unresolvable timezone follows your `unknown_timezone_policy` and defaults to allow, because a configuration hiccup should not black-hole your outbound. At the federal guard, unresolvable means the platform cannot prove the call is inside the window, and at a \$500-per-call penalty floor, guessing is not an option. The dial blocks even at a nominal 2 PM. * **The only refusal you cannot toggle off.** Every other "no" in your send path traces to something you configured, or chose not to configure. A `422 TCPA_FEDERAL_DIALING_WINDOW_BLOCKED` is the one refusal with no setting behind it. You can always layer stricter controls on top of the federal floor. You can never loosen the floor. ## 3. The surrounding carve-out surface The carve-out is narrow on purpose. What routes through the federal guard, and what routes through controls you own: | Refusal | Routed through | Toggleable by you | | - | - | - | | Automated voice dial to a +1 recipient outside 8 AM to 9 PM recipient-local | The federal guard, on every automated voice lane: campaign and dialer blasts, AI-voice agent legs, TTS broadcasts, scheduled callbacks | No | | Automated voice dial to a +1 recipient whose timezone does not resolve | The federal guard, fail-closed | No | | Dial outside the hours you chose | Your tenant quiet-hours, per channel including voice | Yes | | Dial to a country you block | Your tenant country rules | Yes | | Dial to a number on your DNC, suppression, or revoked-consent records | Your tenant suppression and consent checks | Yes | Two clarifications on the edges of that table: * **Any voice, any automated lane, one guard.** The check does not consult your organization settings at all; its only inputs are the recipient number, the resolved timezone, the lane attribution, and the send instant. A campaign path and an AI-voice path that dial the same recipient at the same instant get the same verdict. * **State mini-TCPA overlays are a third, statutory layer.** They narrow the federal window (Florida closes at 8 PM and bans Sunday dialing) but never reopen a federally closed hour. They are law, not a tenant toggle; the intersection mechanics live on [US calling windows](/compliance/state-calling-windows). The transactional lane is part of this surface too, and it is a scope predicate, not a toggle: the statute restricts telephone *solicitations*, so a call positively attributed to the transactional lane (a returned call, an account or delivery notification, a live agent dialling one number by hand) is outside the window's scope entirely. Section 5 and 6 cover what that does and does not let you do. ## 4. The four operator failure modes Four refusals account for nearly every encounter with the guard. Each has its own correction path, and each is documented in depth on a companion page. ### `timezone_unresolved` A +1 recipient whose timezone cannot be derived, typically a non-NANP E.164 that leaked into a US list, or an unmapped Canadian or Caribbean area code. The dial blocks with `timezone`, `local_hour`, and `next_allowed_at` all `null`, and every retry fails closed identically until the contact record is corrected. Fix the recipient's timezone, or remove the record from the list; scheduling does not help, because there is no resolvable window to schedule into. Walkthrough: [Blocked calls in the TCPA window](/troubleshooting/tcpa-window-blocked-calls). Pre-flight a list before dispatch with [quiet-hours preview](/compliance/quiet-hours-preview). ### `outside_federal_window` A resolved timezone, evaluated before 8 AM or at/after 9 PM recipient-local. The refusal carries `next_allowed_at`, the UTC instant of the next 8 AM in the recipient's timezone, computed DST-safely. Schedule against that instant instead of retry-looping; a campaign launch holds to the smallest `next_allowed_at` across its recipients. Same walkthrough and preview tooling as above. ### Transactional-lane miss A call that is genuinely transactional but evaluates against the window anyway, because the lane attribution did not resolve. An absent or unknown lane is read as `marketing` by design: inferring a statutory exemption from a dispatcher's silence is exactly how a campaign path would quietly lose its gate. The attribution is derived from provenance (who placed the call, whether campaign or artificial-voice markers are present), never from an assertion you type into a request. If a legitimate returned-call flow is being held outside the window, the fix is to route it through the dispatcher whose provenance the resolver recognizes, not to seek an exemption flag. Explained on [Voice lanes and classification](/compliance/voice-lane-and-classification-faq); the attribution rules themselves are on [voice traffic lane resolution](/compliance/voice-traffic-lane-resolution). ### Voice-lane misclassification An AI-voice agent leg, a TTS broadcast, or an unattended dial (answering machine detection requested) is an "artificial or prerecorded voice" in the statute's words, and the platform classifies it as marketing however the campaign is labelled. If your AI-voice program is blocked outside the window, that is the classifier applying the law, not a defect to route around. The classification signals and their statutory basis: [Voice lanes and classification](/compliance/voice-lane-and-classification-faq). ## 5. What tenants cannot do The definitive list, with the statutory reason for each item: * **Override the federal window with `startHour` / `endHour` values.** The 8-to-9 window is set by 47 CFR § 64.1200(c)(1). A tenant-widened window would mean the platform originating calls federal law prohibits, and the per-call penalty attaches regardless of whose setting widened it. Your own quiet-hours can narrow your outbound inside the federal window; nothing you set can widen it. * **Fail open on timezone-unresolved recipients.** An unprovable call is not an excused call under § 227(b)(1)(B). Fail-open here would mean "TCPA enforcement stops whenever the timezone lookup fails," which is not a posture the platform can sign for at a $500-to-$1,500-per-call floor. * **Bypass the guard with a `skipTcpa` flag or any metadata key.** Consent and contractual arrangements do not lift the dialing window for solicitation calls; the prior-express-consent carve-out is read by non-voice channels only. A bypass key would let any SDK consumer waive federal law by typing one string, so this class of flag was removed from the voice path and is not offered in any form. There is no metadata key, header, or plan tier that buys one. ## 6. What tenants can do * **Claim the transactional lane the honest way.** Route returned calls, account and delivery notifications, and hand-placed softphone dials through the direct-dial paths whose provenance the resolver reads. The resolver derives the lane; note that it honors a caller's `marketing` declaration but deliberately ignores a `transactional` claim, because metadata is caller-supplied and unauthenticated. Where it lives: [voice traffic lane resolution](/compliance/voice-traffic-lane-resolution) and [Voice lanes and classification](/compliance/voice-lane-and-classification-faq). * **Supply origination metadata that adds governance.** Campaign, journey, broadcast, flow, and artificial-voice markers in call metadata feed the resolver and can only move a call *into* the governed lane, never out of it. If you want a flow treated as marketing, the metadata guarantees it; the reverse direction does not exist. * **Configure recording consent.** Call-recording disclosure and consent are tenant-owned controls, separate from the dialing window entirely. Set them up on [recording consent](/compliance/recording-consent) and the [AI-voice consent guard](/compliance/fcc-ai-voice-consent-guard), with the operational runbook in [DPA, BAA, and recording consent](/guides/compliance-dpa-baa-recording-consent). * **Tighten everything else, anywhere.** Your quiet-hours windows, country rules, and suppression lists can always be stricter than the federal floor: narrower hours, a `deny` timezone policy, broader blocks. See [quiet-hours configuration](/guides/quiet-hours-configuration) and preview the combined verdict with [quiet-hours preview](/compliance/quiet-hours-preview). The one-sentence summary: stricter than the federal floor is always available; looser is not offered at any price. ## See also * [TCPA federal voice guard](/concepts/tcpa-federal-voice-guard) — the companion concept page on the guard's fail-closed design * [Voice Guard decision check](/compliance/voice-guard) — the verdict chain, error body, and worked captures * [Send gates](/compliance/send-gates) — the full gate stack this guard sits above * [Outbound send gating](/concepts/send-gating-and-quiet-hours) — how tenant-owned controls chain at send time This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.